ARToken

T1583.006 — Acquire Infrastructure: Web Services (Resource Development)

Cette technique contourne le MFA car l’authentification s’effectue via l’infrastructure légitime de Microsoft.

# TTP # T1566 — Phishing (Initial Access)

Phishing lures observed are targeted, mimicking legitimate vendor communications, such as an outstanding invoice inquiry, to trick accounts payable personnel.

T1566.002 — Phishing: Spearphishing Link (Initial Access)

Cette technique contourne le MFA car l’authentification s’effectue via l’infrastructure légitime de Microsoft.

T1098.001 — Account Manipulation: Additional Cloud Credentials (Persistence)

Cette technique contourne le MFA car l’authentification s’effectue via l’infrastructure légitime de Microsoft.

T1098.001 — Account Manipulation: Additional Cloud Credentials (Persistence)

T1027 — Obfuscated Files or Information (Defense Evasion)

Rather than linking to an obviously attacker-controlled site, the emails display what appears to be a legitimate SharePoint address while actually directing victims to a look-alike tenant hosted within the attacker's Microsoft 365 workspace.

Cette technique contourne le MFA car l’authentification s’effectue via l’infrastructure légitime de Microsoft.

Before any of that happens, the phishing kit runs a seven layer screening process designed to filter out security scanners and automated bots. It checks browser fingerprints, watches for natural mouse movement, and waits nearly a full second before activating.

T1497.001 — Virtualization/Sandbox Evasion: System Checks (Defense Evasion)

Création de règles de boîte de réception pour masquer ou supprimer des messages

ARToken operates as an affiliate of the EvilTokens phishing-as-a-service operation, which targets Microsoft 365 accounts and bypasses multi-factor authentication.

Vol de tokens d’authentification Microsoft 365

Once entered, the backend silently captures a working access token without asking for a password.

The tool works by abusing a legitimate Microsoft sign in feature meant for devices without a keyboard or browser, tricking victims into approving a login on the attacker’s behalf.

a backend broker generated and polled Microsoft Authentication Broker device-code tokens... allowing the threat actor to recover the token and hijack their account.

Before any of that happens, the phishing kit runs a seven layer screening process designed to filter out security scanners and automated bots. It checks browser fingerprints, watches for natural mouse movement, and waits nearly a full second before activating.

T1497.001 — Virtualization/Sandbox Evasion: System Checks (Defense Evasion)

The panel gives criminal operators a dashboard packed with more than eighty functions, covering everything from refreshing stolen tokens to reading a victim’s entire email inbox. It even offers tools to browse and download files from SharePoint and OneDrive.

Automatisation des opérations de Business Email Compromise (BEC)

ARToken functions as a complete post-compromise toolkit that allows operators to leverage the captured access token recovered following successful device code authentication to maintain access.

T1550.001 — Use Alternate Authentication Material: Application Access Token (Defense Evasion)

The researchers also found tools for conducting business email compromise attacks, including full Outlook mailbox access, the ability to send emails as compromised users, the ability to create inbox rules that automatically forward or hide messages, the ability to monitor multiple mailboxes for keywords simultaneously, and the ability to download email attachments.

Accès complet aux boîtes Outlook ... Surveillance simultanée de plusieurs boîtes compromises par mots-clés

They can also quietly set up inbox rules that hide or delete messages to cover their tracks.

The panel gives criminal operators a dashboard packed with more than eighty functions, covering everything from refreshing stolen tokens to reading a victim’s entire email inbox.

Attackers can also browse, upload, download, and manage files stored in victims' SharePoint sites and OneDrive accounts, enabling data theft and the delivery of malware for additional attacks.

The tool works by abusing a legitimate Microsoft sign in feature meant for devices without a keyboard or browser, tricking victims into approving a login on the attacker’s behalf.

T1567 — Exfiltration Over Web Service (Exfiltration)

ARToken panel exposes 80+ API endpoints for device code phishing, Primary Refresh Token (PRT) persistence, email access, business email compromise (BEC) operations, and SharePoint exfiltration.

T1531 — Account Access Removal (Impact)

The platform also boasts a seven-layer anti-analysis system for evasion.